2

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. Copied objects inherits parent domain security context. Is it possible to write SELinux policy which repeats behavior of the command "cp --preserve=context"? In other words when an object copied from one directory to another it can preserve SELinux type (domain) of the previous parent. For example if the directories structure looks like this

[root@localhost user_test_three]# ls -Zd /tmp/test_dir/test1
drwxrwxrwx. root root system_u:object_r:seuser_object_test_one_t:s0 test1
[root@localhost user_test_three]# ls -Zd /tmp/test_dir/test2
drwxrwxrwx. root root system_u:object_r:seuser_object_test_two_t:s0 test2
[root@localhost user_test_three]# ls -Z /tmp/test_dir/test1 /tmp/test_dir/test2
/tmp/test_dir/test1:
-rw-rw-r--. user_test_four user_test_four seuser_test_four_u:object_r:seuser_object_test_one_t:s0 user_one_test1_file1

/tmp/test_dir/test2:
-rw-rw-r--. user_test_four user_test_four seuser_test_four_u:object_r:seuser_object_test_two_t:s0 user_one_test2_file1

after copying file "user_one_test2_file1" from directory "/tmp/test_dir/test2/" into directory "/tmp/test_dir/test1/" directories' contents should look like this

[root@localhost user_test_three]# ls -Z /tmp/test_dir/test1 /tmp/test_dir/test2
/tmp/test_dir/test1:
-rw-rw-r--. user_test_four user_test_four seuser_test_four_u:object_r:seuser_object_test_one_t:s0 user_one_test1_file1
-rw-rw-r--. user_test_four user_test_four seuser_test_four_u:object_r:seuser_object_test_two_t:s0 user_one_test2_file1

/tmp/test_dir/test2:
-rw-rw-r--. user_test_four user_test_four seuser_test_four_u:object_r:seuser_object_test_two_t:s0 user_one_test2_file1

For now TE file looks this way

policy_module(user_test_threeLB, 1.0.0)
require 
{
    type fs_t;
    type unconfined_t;
    class file 
    { 
        getattr setattr read write rename 
    };
    class dir 
    { 
        getattr setattr read write open rename remove_name add_name 
        create 
    };             
    class filesystem 
    { 
        associate 
    };
    role object_r;
}

type seuser_object_test_one_t;
type seuser_object_test_two_t;
type seuser_object_test_four_t;

role object_r types 
{ 
    seuser_object_test_one_t seuser_object_test_two_t 
    seuser_object_test_four_t 
};

allow seuser_object_test_one_t fs_t: filesystem 
{ 
    associate 
};
allow seuser_object_test_two_t fs_t: filesystem 
{ 
    associate 
};
allow seuser_object_test_four_t fs_t: filesystem 
{ 
    associate 
};

allow unconfined_t seuser_object_test_one_t: file 
{ 
    append create getattr setattr open read write rename unlink 
};

allow unconfined_t seuser_object_test_two_t: file 
{ 
    append create getattr setattr open read write rename unlink
};
allow unconfined_t seuser_object_test_four_t: file 
{ 
    append create getattr setattr open read write rename unlink 
};

allow unconfined_t seuser_object_test_one_t: dir 
{ 
    getattr setattr read write open rename remove_name add_name create 
    search rmdir 
};

allow unconfined_t seuser_object_test_two_t: dir 
{ 
    getattr setattr read write open rename remove_name add_name create 
    search rmdir
};
allow unconfined_t seuser_object_test_four_t: dir 
{ 
    getattr setattr read write open rename remove_name add_name create
    search rmdir
};

userdom_unpriv_user_template(seuser_test_one)
userdom_unpriv_user_template(seuser_test_two)
userdom_unpriv_user_template(seuser_test_four)

role seuser_test_one_r types 
{ 
    seuser_object_test_one_t 
};
role seuser_test_two_r types 
{ 
    seuser_object_test_two_t 
};
role seuser_test_four_r types 
{ 
    seuser_object_test_four_t seuser_object_test_three_t 
    seuser_object_test_two_t seuser_object_test_one_t                              
};

allow seuser_test_one_t seuser_object_test_one_t: dir 
{ 
    add_name create getattr setattr open read remove_name rename rmdir                                                    
    search write 
};
allow seuser_test_one_t seuser_object_test_one_t: file 
{ 
    append create getattr setattr open rename read write 
};

allow seuser_test_two_t seuser_object_test_two_t: dir 
{ 
    add_name create getattr setattr open read remove_name rename rmdir 
    search write 
};
allow seuser_test_two_t seuser_object_test_two_t: file 
{ 
    append create getattr setattr open rename read write 
};

allow seuser_test_four_t seuser_object_test_one_t: dir 
{ 
    add_name create getattr setattr open read remove_name rename rmdir 
    search write 
};
allow seuser_test_four_t seuser_object_test_one_t: file 
{ 
    append create getattr setattr open rename read write 
};

allow seuser_test_four_t seuser_object_test_two_t: dir 
{ 
    add_name create getattr setattr open read remove_name rename rmdir 
    search write 
};
allow seuser_test_four_t seuser_object_test_two_t: file 
{ 
    append create getattr setattr open rename read write 
};

allow seuser_test_four_t seuser_object_test_four_t: dir 
{ 
    add_name create getattr open read remove_name rename rmdir search 
    write 
};
allow seuser_test_four_t seuser_object_test_four_t: file 
{ 
    append create getattr open rename read setattr write 
};
gen_user(seuser_test_one_u, user, seuser_test_one_r, s0) 
gen_user(seuser_test_two_u, user, seuser_test_two_r, s0)
gen_user(seuser_test_four_u, user, seuser_test_four_r, s0)

I tried to use "constrain" Macros written this way constrain dir_file_class_set { create relabelto relabelfrom } ( u1 == u2 or t1 == can_change_object_identity ); But this led to errors during policy compilation. Use of neverallow Macro also did not help (of course). In my TE neverallow directive looked like this

neverallow seuser_test_four_t seuser_object_test_four_t: dir 
{ 
    relabelfrom relabelto 
};
neverallow seuser_test_four_t seuser_object_test_four_t: file 
{ 
    relabelfrom relabelto 
};

In my research i used extensively selinuxproject.org and this tutorial.

Once more the question is if it is possible to write SELinux policy the way to repeat the behavior of the command "cp --preserve=context"? In other words when an object copied from one directory to another it preserves type of the previous parent. This question:How to copy SELinux context from one directory and apply it to another directory? is a bit different as mine relates only to poicies, i.e. TE files not tools.

  • Any particular reason you are not using file_type() macro? – sebasth Oct 20 '18 at 18:01
  • Behavior of cp, and other SELinux aware tools, contain the logic to copy/apply correct security contexts. The policy also needs to allow relabeling in question for the tools to work. I'm not sure that it is possible to implement such functionality generally without SELinux awareness in the tool. – sebasth Oct 20 '18 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.